CVE-2020-10189criticalunder attackCWE-502

CVE-2020-10189

Published · Updated

Follow this CVE+ Monitor ManageEngine ServiceDesk

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has a working public exploit and 1 threat group(s) use it.

ssvc Actcvss 9.8epss 100%
from disclosure to weapon11 days
Published on NVDMar 6
1st PoC+11d
metasploitMar 5
CISA KEV+607d
Who exploits it — 1

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

APT / StateAPT41🇨🇳 MITRE ATT&CK
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

Zoho ManageEngine Desktop Central versions before 10.0.474 have a critical flaw where attackers can execute arbitrary code on the server by sending specially crafted requests that exploit unsafe data deserialization. This allows complete compromise of the affected system without authentication.

Technical detail

A deserialization vulnerability in the FileStorage class's getChartImage method allows unauthenticated remote code execution via CewolfServlet and MDMLogUploaderServlet endpoints. Attackers can craft malicious serialized Java objects that execute arbitrary code when deserialized, resulting in full system compromise with CVSS 9.8.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage class. This is related to the CewolfServlet and MDMLogUploaderServlet servlets.
CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.